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Abstract 


An adaptive control architecture for safe performance of a transport aircraft 
subject to various adverse conditions is proposed and verified in this report. 
This architecture combines a nominal controller based on a Linear Quadratic 
Regulator (LQR) with integral action, and an adaptive controller that ac- 
commodates actuator saturation and bounded disturbances. The effectiveness 
of the baseline controller and its adaptive augmentation are evaluated and 
compared using a stand-alone control verification methodology. Case stud- 
ies that pair individual parameter uncertainties with critical flight maneuvers 
are studied. The resilience of the controllers is determined by evaluating the 
degradation in closed-loop performance resulting from increasingly larger de- 
viations in the uncertain parameters. Symmetric and asymmetric actuator 
failures, flight upsets, and center of gravity displacements, are some of the 
uncertainties considered. 

Nomenclature 

b re f wingspan 

c re f mean aerodynamic chord 

Cl Aerodynamic force coefficient in the minus ^-direction of the wind axes 
Cd Aerodynamic force coefficient in the minus x-direction of the wind axes 
Cy Aerodynamic force coefficient in the minus y-direction of the wind axes 
Ci Aerodynamic moment coefficient in the x-direction of the body axes 
C m Aerodynamic moment coefficient in the y-direction of the body axes 
C n Aerodynamic moment coefficient in the ^-direction of the body axes 
C xy Partial derivative of C x with respect to y 
d Design variable 

e State error 

/ Flight maneuver 

T Failure domain 

g Constraint function 

h Altitude 

lab Component of the inertia tensor in the ab direction 

L Aerodynamic torque in the in the x-direction of the body axes 

M Aerodynamic torque in the in the y-direction of the body axes 

A4 Maximal set 

N Aerodynamic torque in the in the ^-direction of the body axes 

p Uncertain parameter 

p Nominal parameter point 

p Critical parameter value 

u n Baseline control 
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u a Adaptive control 

Uo Control value for trim 

u Component of the velocity relative to the air in the ^-direction of the body axes 

v Component of the velocity relative to the air in the y-direction of the body axes 

w Component of the velocity relative to the air in the 2-direction of the body axes 

W Vehicle’s weight 

x state vector of the plant 

x m state vector of the reference model 

X Aerodynamic force in the in the x-direction of the body axes 

Y Aerodynamic force in the in the y-direction of the body axes 

Z Aerodynamic force in the in the 2-direction of the body axes 

a Critical similitude ratio 

A* CG position in the x-direction of the body axes relative to a reference point 

A y CG position in the y-direction of the body axes relative to a reference point 

A z CG position in the 2-direction of the body axes relative to a reference point 

A Control effectiveness matrix 

p Parametric safety margin 


Acronyms 

CG Center of gravity 

CPV Critical parameter Value 

CSR Critical Similitude Ratio 

DOF Degrees of fredom 

FC Flight Condition 

GTM Generic Transport Model 

LQR Linear Quadratic Regulator 

MS Maximal Set 

PSM Parametric Safety Margin 


1 Introduction 

The challenge of achieving safe flight comes into sharp focus in the face of 
adverse conditions caused by faults, damage, or upsets. When these situations 
occur, the corresponding uncertainties directly affect the safe operation of the 
aircraft. A technology that has the potential for enabling safe flight under 
these adverse conditions is adaptive control. One of the main features of an 
adaptive control architecture is its ability to react to changing characteristics 
of the underlying aircraft dynamics. This paper proposes the building blocks 
of an adaptive and reconfigurable control technology that ensures safe flight 
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under adverse flight conditions. This technology enables synthesis of such 
controllers as well as systematic evaluation of their robustness characteristics. 


The field of adaptive control is a mature theoretical discipline that has 
evolved over the past fifty years, embodying methodologies for controlling un- 
certain dynamic systems with parametric uncertainties [1]- [2], Through the 
efforts of various researchers over this period, systematic methods for the con- 
trol of linear and nonlinear dynamic systems with parametric and dynamic 
uncertainties have been developed [3]- [4], Stability and robustness properties 
of these systems in the presence of disturbances, time- varying parameters, un- 
modeled dynamics, time-delays, and various nonlinearities, have been outlined 
in the references [1]- [5] as well as in several journal and conference papers over 
the same period. 


In this paper, we consider the control of a transport aircraft model that 
resembles the Generic Transport Model [6]. While the vehicle’s geometry and 
aerodynamic model are those of a C5 aircraft [9] , every other aspect has been 
made similar to the GTM, e.g. anti wind-up logic, time-delay due to teleme- 
try, baseline control structure, low-pass and wash-out filters. We delineate 
the underlying nonlinear model of this aircraft, and introduce various types 
of damages, and failures into this model. An adaptive control architecture 
is proposed which combines a nominal controller that provides a satisfactory 
performance in the absence of adverse conditions, and an adaptive controller 
that is capable of accommodating various adverse conditions including actua- 
tor saturation. The specific adverse conditions considered can be grouped into 
the following three categories, (a) upsets, ( b ) damages, and (c) actuator fail- 
ures. Specific cases in (a) include flight upsets in initial conditions of various 
states including angle of attack, cases in ( b ) include situations where struc- 
tural failures cause changes in the location of the Center-of-Gravity (CG) [7], 
while cases in (c) include situations where symmetric and asymmetric failures 
in control surfaces and engines occur. These failures include loss in control 
effectiveness, and locked-in-place control surfaces. 


The resilience of the adaptive controller to uncertainty is evaluated for 
safety using the control verification methodology proposed in [8] . This method- 
ology enables the determination of ranges of uncertainty for which a prescribed 
set of closed-loop requirements are satisfied. This paper studies several one- 
dimensional uncertainty analyses for two flight maneuvers that focus on the 
longitudinal and lateral dynamics. As compared to the baseline controller, the 
adaptive controller enlarges the region of safe operation by a sizable margin 
in all but one of the cases considered. 
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2 The GTM-Like Aircraft 


In this section, we begin with a description of a nonlinear dynamic model of 
C5, a large transport aircraft whose aerodynamics data is available in [9]. We 
consider rigid body dynamics, aerodynamics, effect of the control inputs, and 
derive the overall nonlinear flight model. We then discuss adverse conditions 
such as flight upsets, damage, and failures, and how to model them. 

2.1 Nonlinear Dynamic Model 

A typical dynamic model of an aircraft consists of the equations of motion, 
aerodynamics, actuator dynamics, actuator saturation, and sensor dynamics. 
The standard conservation equations [10] describe the dynamics of u, v, and 
w , the body-fixed aircraft velocities; p, q, and r, the roll, pitch, and yaw rates; 
and the Euler angles </>, 0 , and ip. The aircraft’s flat-Earth equations of motion 
are given by 


X . . 

u = g— — gsmt) — qw + rv, 

(1) 

Y „ . , 

(2) 

v = g— + g cos 0 sm <p — ru + pw, 

Z 

(3) 

w — g— + g cos 0 cos cp + qu — pv , 

p=y^[L + l X zPq - ( hz - Iyy) qr ] + y 1 [N - I xz qr - (Iyy - 
Jd Id 

-Ixx)pq], ( 4 ) 

q = ~j~ [M — (I xx - I zz ) pr - I xz (p 2 - r 2 )] , 
1 yy 

(5) 

f = ^[L + I xz pq - (I zz - I yy ) qr] + ^ [N - I xz qr - (I yy - 

-i X x)pq], (6) 

<j> — p + q sin cj) tan 0 + r cos (f) tan 0 , 

(7) 

0 — q cos (f) — r sin 0, 

(8) 

ip — (q sin cp + r cos <p ) sec 0, 

(9) 

In the above, Id — I X xJzz — I xz \ X , Y , and Z are the aerodynamic forces 
in body axes at the actual center of gravity (CG), and L, M, and N are the 
aerodynamic moments about the same point. See the Nomenclature section 
and Table 1 for the meaning of other symbols. The values of the gross aircraft 

weight W, the moments of inertia I xx , I yy , and I zz , as well as 
inertia I xz can be found in [9] . 

the product of 
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The following navigation equations determine x and y, the positions of the 
aircraft in the north and east directions respectively, as well as the altitude h: 

x — u cos 9 cos ip + v{— cos <p sin ip + sin <p sin 9 cos ip)+ (10) 

to (sin (p sin ip + cos <p sin 9 cos ip ) , 

y — u cos 9 sin ip + v(cos <p cos ip + sin <p sin 9 sin ip)+ ( 11 ) 

w(— sin <p cos ip + cos <p sin 9 sin ip ), 
h — u sin 9 — v sin <p cos 9 — w cos (p cos 9. ( 12 ) 

It is often convenient to replace the body-fixed velocities with the true airspeed 
Vt , the angle-of-attack a, and the side-slip angle /3. These new states can be 
calculated from the body-fixed velocities, neglecting wind and gust-induced 
effects, as 


Vt = Vu 2 + v 2 + w 2 , 

(13) 

w 

tana = — , 

(14) 

u 

■ p v 

S '^=V T 

(15) 


It is well known [11] that the aerodynamic forces and moments acting on 
the aircraft can be expressed in terms of the non-dimensional force and moment 
coefficients through multiplication by a dimensional factor and, in the case of 
the forces, a transformation from wind to body axes. The forces and moments 
are therefore given by 


X~ 


cos a 0 

1 — sin a 


—Cd cos j3 

Y 

= qS 

0 1 

0 


Cy 

Z 


sin a 0 

cos a 


~ C l 

L 


b-ref Cl 



M 

= qS 

Cref C m 

5 


N 


_brefC n ~ 




(16) 

(17) 


where Cl, Cd, and Cy are the lift, drag, and side-force coefficients respectively 
while Ci, C m , and C n are the moment coefficients. The values of the wingspan 
b re f, the mean aerodynamic chord c re f, and the wing surface area S can be 
found in [9]. 

Table 1 shows the aircraft states, plant (i.e. , inputs to the plant), control 
(i.e., outputs of the controller), and pilot inputs. The system state vector 
given by 

x — \Vt a/3pqr<p9ipxy h] T . (18) 

The pilot inputs are commands to ailerons, rudders, and elevators. The plant 
inputs are the 4 engine throttles and the deflections of 6 control surfaces (i.e., 
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Table 1. Aircraft states, actuators, and pilot inputs. 


Variable 

Description 

Component of 

v t 

Velocity 

State (as) 

a 

Angle of Attack 

State (as) 

0 

Side-slip Angle 

State (as) 

(t> 

Euler Angle 

State (as) 

6 

Euler Angle 

State (as) 


Euler Angle 

State (as) 

V 

Roll Rate 

State (as) 

Q 

Pitch Rate 

State (as) 

r 

Yaw Rate 

State (as) 

ti 

Left outboard Throttle 

Plant input 

t<2 

Left Inboard Throttle 

Plant input 

t3 

Right Inboard Throttle 

Plant input 

U 

Right outboard Throttle 

Plant input 

ei 

Left Elevator 

Plant input, Control output ( u ) 

e2 

Right Elevator 

Plant input, Control output ( u ) 

ai 

Left Aileron 

Plant input, Control output (ti) 

«2 

Right Aileron 

Plant input, Control output (ti) 

ri 

Lower Rudder 

Plant input, Control output (ti) 

V2 

Upper Rudder 

Plant input, Control output (ti) 

^e,cmd 

Virtual Elevator 

Pilot input (r) 

^a,cmd 

Virtual Aileron 

Pilot input (r) 

•5r,cmd 

Virtual Rudder 

Pilot input (r) 
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two for elevators, ailerons and rudders). As in the current version of the GTM 
the engines are not used for control and the throttle values will be fixed at 
their trim values. 

The inputs available to the pilot are the elevator, aileron, and rudder com- 
mands denoted as Afy cmd , A5 a>cmd , and A5 r>cmd . The aerodynamic force and 
moment coefficients are given by 


Cl — C La a + C Lsp 8 e , 
Cd — Cdc ck + Co Se 8 e , 

Cy = Cy 0 (3 + Cy p Pl^t 


+ C Yr r 


bref 
2 Vt 


+c cU 


+ Oy Sa S a + CY Sr S r , 


(19) 


Cl - C h P + Ci pP ^ + C lr r^t + Ci.p^ + CiJ a + C lSr 8r, 

Cm — Cm a a + CmgQ^r + C m& dl + C mge 5 e , 

C n = C n0 P + C np P^C~ + C nr T + C nfi P^C -)_ C nga 8 a + C^A, 


( 20 ) 


where 


& = 


ei + e 2 

2 ’ 
a\ — a 2 

, r-1 + r 2 

Cr ~ i 


( 21 ) 


where these symbols are specified in Table 1. These set of equations prescribe 
the non-dimensional coefficients in Equations (16) and (17) as a a function 
of the state. In the context of this paper, the control surface deflections are 
related to the control inputs by u\ = e\, u 2 = e 2 , Uz = Oi, = a 2 , u 5 = r 1: 
and u fi — r 2 . Overall, the aircraft dynamics is given by the equations above 
along with an aerodynamic model. Such a model The model to be used herein 
is prescribed subsequently. 

We can compactly describe the overall nonlinear model as 


X = F(X, A U) 


( 22 ) 


where the input U consists of w*, for i — 1, ..6, and A is the control effectiveness 
matrix. 

For control purposes, the nonlinear plant is linearized about a trim point 
(A 0 , Uo) satisfying F(A 0 , f/ 0 ) = 0. This leads to the linear time invariant 
system 

x p — A p Xp + B p u + g(x p , u) (23) 
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where 


SF(X,U) 

r ax 


7 


u 0 


B p - 


dF(X, U) 


dU 


Xq, U 0 


and g(x p , u ) represents higher order terms. 


(24) 


2.2 Adverse Conditions 

We now describe the three categories of upsets, damage, and failures that we 
shall introduce in the above model. 


Flight upsets: These adverse conditions result from large deviations in the 

initial conditions of the state from the trim point at which the plant is derived. 
In this paper, such deviations will be called flight upsets regardless of their 
size. If a linear system is input-output stable, guarantees for a bounded state 
are automatically obtained. In practical situations the closed-loop system is 
subject to unknown bounded disturbances, case in which only uniform ultimate 
boundedness for linear plants has been proved. This implies that there are 
initial conditions for which the state may grow unbounded. Whether the 
actual responses are bounded and actually stay within acceptable limits needs 
to be demonstrated. In this paper, the initial condition of a will be considered 
uncertain. Since the baseline controller designed for the GTM does not enable 
lateral command following, flight upsets in /?(0) are omitted. 


CG movement: A serious condition that needs to be addressed is structural 

damage. This causes, among other things, a movement of the CG from its 
nominal position. Changes to the moments in Equation (17) in a post-failure 
state are given by 


A L 


Ax 


cos a 

0 

— sin a 


—Cd cos/? 

AM 

— 

Ay 

x qS 

0 

1 

0 


Cy 

AN 


Az 


sin a 

0 

cos a 


-C L 


where [Ax, Ay, A z] is the position vector of the actual CG location from the 
reference point in body axes. The contribution of the tangential component 
of the acceleration can be accounted for by using the inertia tensor about the 
actual CG, which is related to the nominal CG by 


l CG 


= /, 


nominal 


m 


Ay 2 + A z 2 

AxAy 

AxAz 


AxAy 
Ax 2 + A z 2 
AyAz 


AxAz 
AyAz 
Ax 2 + Ay 2 


(26) 


In the studies that follow the contribution of the centripetal component of the 
acceleration resulting from CG movement is ignored. The reader can refer 
to [7] for an explicit formulation of the equations of motion. 
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Actuator Failures: We now consider adverse conditions that result from 

loss of control effectiveness and time delay. 

As in reference [12], we model these failures by pre-multiplying the B p 
matrix of the linearized model by the control effectiveness matrix A. That 
is, the B p matrix in (23) is changed to B p A where A is a matrix of dimension 
6x6, which is equal to the identity matrix in the nominal case. Loss of control 
effectiveness is modeled by making the terms in the diagonal of A less than 
one. For example, if the right elevator fails by 50%, and the left aileron fails 
by 40%, A takes on the form 

A = diag [1,0.5, 0.6, 1,1,1] . 

In general, the control effectiveness matrix takes the form 

A = diag [A e i, A e 2 , A 0 i, A a 2 , A r i, A r 2 ] , (27) 

where 0 < max{A} < 1. 

In addition to these actuator failures we will also consider time delay in all 
six control inputs and control surface lock-ups. In the latter type of failure, the 
duration of the lock-in-place failure will be consider an uncertain parameter. 
Note that from all uncertainties mentioned above, only those in A affect the 
value of the control Uq at trim. 

3 Adaptive Control Architecture 

The proposed control architecture augments a nominal controller with an adap- 
tive component. While the nominal controller is designed to meet the perfor- 
mance requirements under ideal operating conditions, the adaptive one copes 
with failures and uncertainties. The very same structure of the controller that 
was designed at Langley Research Center for the GTM will be used in the 
nominal controller. Details on such a structure are presented next. 

3.1 Nominal Controller 

The nominal controller has three main components, an array of low-pass and 
wash-out and filters, an LQR controller with integral action, and a hard-limiter 
to cope with control saturation. This limiter enforces an anti-integration wind- 
up logic based on the elevator deflection. This logic makes the system non- 
linear and time varying. Each of these components is described in more detail 
next. 


3.1.1 Washout Filters and Low-pass Filters 

The GTM model has an array of low-pass and wash-out and filters to mitigate 
measurement noise and improve handling qualities. A block diagram of the 
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system is shown in Figure 1. In particular, the states a, p, q, and r will be 
low-pass filtered but only p, q, and r will be washed-out. These filters will be 
taken into account when designing the nominal controller. 


Nominal 

Controller 


U 0 

^ < 5 - 


Washout 

filters 


plant-model 

I === 


s 


Cl 

S + C2 


s + Cl 


low-pass 

filters 




Figure 1. Washout filters and low-pass filters 


3.1.2 LQR Controller with Integral Action 

For control design purposes, we assume that the pitch, yaw and roll dynamics 
are weakly coupled. In order to closely follow a command in angle of attack, 
an integral state e a is added 


e Q — /(cK CKcmd ~)dt 


(28) 


where a cm d = 105 e ,cmd for 0 < 5 e ,cmd < 1. Note that elevator command does 
not affect elevator angle, instead it generates integral error. The signal 5 e , C md 

is one of the plant inputs in 6 cmd = [5 e ,cmd, ^a.cmd, 4,cmd] • The augmented 
plant dynamics is therefore described as 


x r . 


A p 

0 

H 

0 


x„ 


+ 


B r 


u + 


0 

-1 


^cmd 


(29) 


0 

x A x B\ B 2 

Since the states in Equation (29) are accessible, an LQR controller is designed 
as 


= K s , t K S . ,] 


a 

q 


fia,n 


\K S 

°a p 

K s 1 \ 

Oar 


P 

+ 

3a,cmd 

&r,n 


K s 

_ o rp 

Ks 

°r r J 


r 

3r,cmd 


(30) 


V 

■^r^cmd 


where the control gains K§ minimize the cost function 

J — J (jx R xx x H - u R uu u)dt, 


(31) 
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and R xx , R uu are weighting matrices. As in the Langley controller, the gains 
Kg ar and Kg rp of the stability augmentation system in (30) are set to zero to 
eliminate coupling between the lateral and directional dynamics. When only 
the baseline controller is used u — u n — [£ e)n , 8 ayni 8 ryn ] and that e\ — e-i — 
8 ejn /2, oi = —02 = 8 ajn / 2 and rq — — 8 r , n / 2. Equations (28)-(30) describe 

the 6 DOF closed-loop dynamics of an LTI approximation of the GTM for an 
LQR controller with integral action. 


3.2 Saturation 


To ensure that the control input does not exceed the saturation limits for the 
three control surfaces, the rectangular saturation function 


Rai^i) 


Ui 

Ri,max 


if Ui ^ U i y max j 


sign('Uj) if \Ui\ > Ui tmax , 
is used. The control deficiency caused by saturation is given by 

•ua = u — R s {u). 


(32) 


(33) 


Besides this physical saturation constraint, an anti- windup logic that de- 
pends on e a is also implemented. This logic is governed by the time- varying 
saturation function 


Beifion 8e ( 0 ) 

where e ava ii ab ie is given by 

^available — mBX 


a if &a ^ 0 01 e a ^ ^available? 

^available if &a ^ 0 Bnd 6 a !> ^available* 


(34) 


{* 


R 3 {8e) (^e,trim T A"<5 eQ ® T Kg eq Qvu) 


Kx 


) 


(35) 


The error deficiency caused by the saturation function in Equation (34) is 
defined as 


® a , a — R e (e a: 8 e (t )). 


(36) 


By replacing u with R s (u n ), and e a with R e (e a , 8 e (t )) in Equation (29) we 
obtain the linear time varying system 


Xr, 


Ap B p K Xp 
H 


~B p Kg ea 

0 


X r . 


+ 


B r 


K r 8, 


r^cmd 


+ 






s -- 


A w 

1 


X 1 

' 0 " 
-1 

&cmd 

CQ O 
1 

ua — 

—B p Kg ea 

0 


^a,A 5 


(37) 


B 2 


Ri 


R2 
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which is the closed-loop system corresponding to the nominal controller. The 
boundedness of this system can be established for all initial conditions inside 
a bounded set. This set extends to the entire state-space when the open-loop 
plant is stable and there is no unmodeled dynamics, e.g., no time-delay. 

3.3 Adaptive Controller 

Since the nominal controller in (30) has been designed for a plant-model under 
nominal conditions, it may prove to be inadequate in the face of failures and 
uncertainties. To compensate for this we augment the controller in (30) with 
an adaptive component as follows: 

u — Uq u n + u a = Uq + ( K -\- 0 x )x + {K r + 9 r )r -1- / (38) 

where K and K r are the feedback and feedforward gains of the baseline con- 
troller, while 9 X , 9 r , and / are adaptively adjusted to minimize the state error 
between the controlled plant- model and a reference model. / is chosen to 
generate the desired plant output for the commanded input. In the current 
problem, the reference model is prescribed by the non-linear closed-loop sys- 
tem corresponding to the baseline controller for the case where there are no 
uncertainties. None of the saturation functions above are included in the ref- 
erence model. Figure 2 shows the block diagram of this control architecture. 
Adaptive controllers for the GTM using a reference model that accounts for 



Washout low-pass 

filters filters 


Figure 2. Control Architecture. 


the time delay in telemetry have shown promise. Such controllers, however, 
will be presented in future publications. 

Let the reference model be prescribed by x m — f(x m ,u ), where x m is the 
reference model state. Linearization of this model about (Xo, Uq) leads to 

•Emi — A-mX m i T B m u T g(x m i, u). (39) 

Defining the state error e as 

e — x - x m (40) 


12 



we choose the adaptive laws [1] for adjusting the adaptive parameters in (38) 
as 

9 X — -F 1 B T Pe u x T - <J\9 X 
9 r — — r 2 B T Pe u r - o 2 9 r 

x (41) 

/ = -r 3 B T Pe u - a 3 9 f 

A — -r 4 diag(rtA)5jPe„ - cr 4 A 

where A^P + PA m — — Q, Q > 0, T* is diagonal and positive definite for 
i — 1, ...4, and e u — e~ e&. The auxiliary error eA is defined as 

e A = A m e& - i2idiag(A)rt A - (42) 

Note that if the control does not saturate ua = 0, eA — * ► 0 and e u — * e. e a 
is the error that occurs due to saturation, and by subtracting it out from e, 
we obtain e u which is the sum of the error due to uncertainties and the error 
due to e Q> A- The a modifications prevent the drift of the adaptive parameters 
9 X i 9 ri f and A caused by disturbances. The term / is an adaptive parameter 
aimed at counteracting constant disturbances. 

It should be noted that the stability and boundedness of the closed-loop 
augmented system has been proved in [3, 13, 14] when physical saturation con- 
straints are present. However, the stability analysis for the anti-windup logic 
in Equation (34) remains to be established. 

4 Control Verification 

This section introduces a framework for evaluating the degradation in closed- 
loop performance caused by increasingly larger values of uncertainty. This 
is attained by determining the largest hyper-rectangular set in the uncertain 
parameter space for which a set of closed-loop requirements are satisfied by all 
set members. A brief introduction to the mathematical framework required 
to perform this study is presented next. References [8] and [15] cover this 
material in more detail. 

4.1 Mathematical Framework 

The parameters which specify the closed-loop system are grouped into two 
categories: uncertain parameters, which are denoted by the vector p, and the 
control design parameters, which are denoted by the vector d. While the plant 
model depends on p (e.g., aerodynamic coefficients, initial conditions, time 
delay, actuator failures), the controller depends on d (e.g., control gains). The 
Nominal Parameter value, denoted as p, is the value that p assumes when 
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there is no failure/uncertainty. The value of d on the other hand is assumed 
to be available and will remain fixed. 

Stability and performance requirements for the closed-loop system will be 
prescribed by the set of constraint functions, g(p, d ) < 0 . This vector inequal- 
ity, and all others that follow, hold component wise. For a fixed d, the larger 
the region in p-space where g < 0 , the more robust the controller. The Failure 
Domain corresponding to the controller with parameters d is given by 1 

dim(g) 

T(d) = |J P(d). ( 43 ) 

3 = 1 

F 3 (d) = {p : gj(p , d) > 0 }, ( 44 ) 

While Equation ( 44 ) describes the failure domain corresponding to the jth 
requirement, Equation ( 43 ) describes the failure domain for all requirements. 
The Non-Failure Domain is the complement set of the failure domain and will 
be denoted 2 as C{J~). The names “failure domain” and “non-failure domain” 
are used because in the failure domain at least one constraint is violated while, 
in the non-failure domain, all constraints are satisfied. 

Let 0 be a set in p-space, called the Reference Set , whose geometric center 
is the nominal parameter p. The geometry of Cl will be prescribed according 
to the relative levels of uncertainty in p. One possible choice for the reference 
set is the hyper-rectangle 

lZ(p, n) — {p : p — n < p < p + n} . ( 45 ) 

where n > 0 is the vector of half-lengths. One of the tasks of interest is to 
assign a measure of robustness to a controller based on measuring how much 
the reference set can be deformed before intersecting the failure domain. The 
Homothetic Deformation of Cl with respect to the nominal parameter point p 
by a factor of a > 0 , is the set Ti.(Cl, a) = {p + a(p — p) : p E 17}. The factor 
of this deformation, cr, is called the Similitude Ratio. While expansions are 
accomplished when a > 1, contractions result when 0 < a < 1. Hereafter, 
deformations must be interpreted as homothetic expansions or contractions. 

In what follows we assume that the controller d satisfies the requirements 
for the nominal plant, i.e., g(p,d) < 0 . Intuitively, one imagines that a ho- 
mothet of the reference set is being deformed until its boundary touches the 
failure domain. Any point where the deforming set touches the failure domain 
is a Critical Parameter Value (CPV). The CPV, which will be denoted as p, 
might not be unique. The deformed set is called the Maximal Set (MS) and 

1 Throughout this paper, super- indices are used to denote a particular vector or set while 
sub-indices refer to vector components, e.g., p] is the ?'th component of the vector p> . 

2 The complement set operator will be denoted as C{-). 
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will be denoted as M.. The MS is the largest homothet of D that fits within 
C(fF). The Critical Similitude Ratio (CSR), denoted as a, is the similitude 
ratio of that deformation. While the CSR is a non-dimensional number, the 
Parametric Safety Margin (PSM), denoted as p and defined later, is its dimen- 
sional equivalent. Both the CSR and the PSM quantify the size of the MS. 
Details on the implementation of these ideas are presented next. 

The CPV corresponding to the deformation of D = 7 Z(p, n) for the jth 
requirement is given by 

p> = argmin {||p - p\\™ : gj(p, d) > 0 ,Ap>b}, (46) 

v 

where ||x||£° = supj{|xj|/rij} is the n-scaled infinity norm. The last constraint 
in Equation (46) is used to exclude regions of the parameter space where plants 
are infeasible and uncertainty levels are unrealistic. The overall CPV is 

p=p k , (47) 

where 

*= argmin {\\pi - p||£°} . (48) 

l<J<dim(s) 

The critical requirement, which is the one preventing a larger deformation, is 
gk < 0. Once the CPV has been found, the MS is uniquely determined by 

M. (d) = 7 Z(p, an). (49) 

where a = \\p — p||£°. The Rectangular PSM is defined as 

p = a||n||, (50) 

The last two equations, which apply to the overall CPV, can be extended to 
individual CPVs, by using pi instead of p. Note that overall PSM is equal to 
the smallest individual PSM. 

Because the CSR and the PSM measure the size of the MS, their values are 
proportional to the degree of robustness of the controller associated with d to 
uncertainty in p. The CSR is non-dimensional, but depends on both the shape 
and the size of the reference set. The PSM has the same units as the uncertain 
parameters, and depends on the shape, but not the size, of the reference set. 
If the PSM is zero, the controller’s robustness is practically nil since there are 
infinitely small perturbations of p leading to the violation of at least one of 
the requirements. If the PSM is positive, the requirements are satisfied for 
parameter points in the vicinity of the nominal parameter point. The larger 
the PSM, the larger the D-shaped vicinity. 
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4.1.1 

One-dimensional Case 


In the case where dim{p} = 1, the expressions for the CPVs, 
the MS are given by 

the PSM, and 


p> - argmin {\p - p\ : gj(p, d) > 0 ,Ap>b}, 

V 

(51) 


II 

(52) 


p = \p k -p\, 

(53) 


M(d) - (p-p,p + p), 

(54) 

where 

k = argmin {Jp 7 — p| } . 

(55) 

Figure 3 shows an sketch with relevant variables and sets. 

Note that the 


non-failure domain is given by the intersection of the individual non-failure 
domains. Besides, the overall CPV is the parameter value closest to the nom- 
inal point where at least one component of g is equal to zero. Prom the figure 


we see that p 1 — p < p — p 2 so p 


p 1 and k — 1. By construction, all the 


points within the MS, which is centered about the nominal parameter point, 
satisfy the closed-loop requirements. 



Uncertain parameter, p 

Figure 3. Relevant variables in a 1-dimensional p-space for a fixed d. 


As expected, analyses arising from considering each uncertain parameter 
individually are unable to capture the effect of the dependencies among un- 
certain parameters. When such dependencies are important, the collection 
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of PSMs that result from performing dim(p) one-dimensional deformations 
can misrepresent the actual system’s robustness. For instance, if p 1 is the 
PSM corresponding to a one-dimensional deformation in pi, p 2 is the PSM 
corresponding to a one-dimensional deformation in p 2 , and p 3 is the PSM cor- 
responding to a two-dimensional deformation in [pi , P 2 ] ; it is possible to have 
p 3 <C minlp 1 , p 2 }. In such a case there is a combination of uncertain parame- 
ters much closer to p that will be missed by both one-dimensional searches. 

4.2 Analysis Setup 

4.2.1 Uncertain Parameters 

We will consider the following set of uncertain parameters 

[A e le 1 A a ;i, A rud , T , tfa A x , Ay , Ao;(0)] , (56) 

where the first 6 components, can be categorized as actuator uncertainties or 
failures, the next two account for structural failures and last one for a flight 
upset. In particular, 

Aele = 

A a il 

Arud 

A t hr 

arc; the control effectiveness of elevators, ailerons, rudders, and engine throttle; 
r is a time delay in all input channels, and t\ is the duration of a control surface 
lock-up. The terms A x and A y are components of the position vector in the xy- 
body frame of the post-failure CG location with respect to a reference point. 
The last component, which models a flight upset, is the initial condition in 
angle of attack. The nominal parameter values corresponding to the set of 
parameters in Equation (56) is [1, 1, 1, 1, 0, 0, 0, 0, 0]. 

4.2.2 Closed-loop Requirements 

The following stability and performance requirements will be considered 

go — m8x([U(fj ro W-rriax ■ ^rnin (58) 


[A e l, A e 2] 

[AqI , A 0 2] 

[A r l , A r 2 j 

[An, A* 2 , Xt3, An] 


(57) 


g i 



-2.5, 


(59) 


g 2 


((J! Q!cmd) T k a OL T (/? /^cmd) T kp@ Cl, 

J t=tf 


(60) 


17 



2 


( 61 ) 


g 3 = rj(p, d ) - c 2 rj(p, d base ), 


V - u>i||a - a cmd \\ 2 + w 2 \\p - p cmd \\ 2 + w 3 \\r ~ r cmd 


where || • H 2 is the L 2 norm in the interval [0, tf\. The first requirement, go < 0, 
is used to determine if the vehicle has enough control authority to trim, i.e. 
if it satisfies u min < Utrim < u max ■ Note that this requirement is independent 
of d and may indicate instability, gi < 0 is a structural requirement enforced 
by preventing the loading factor from exceeding the upper limit of 2.5. The 
requirement g 2 < 0, where 0 < C\ -C 1, A; a > 0 and kg > 0, enforces stability 
and satisfactory steady state performance. The last requirement, g 3 < 0, for 
C 2 > 1, W\ > 0 , w 2 > 0 and w 3 > 0, is used to measure satisfactory transient 
performance. This requirement prevents the cumulative error from exceeding 
a prescribed upper limit. Such a limit is c 2 times larger than the cumulative 
error incurred by the baseline controller under nominal flying conditions. 

In practice, control requirements are prescribed in advance before the con- 
trol design process even starts. When such requirements are only described 
qualitatively several implementations of the constraints g are possible. This 
creates the additional challenge of constructing functional forms that capture 
well the intent of the requirement while having a minimal amount of conser- 
vatism. This paper does not tackle such a challenge and assumes that the g 
above is given. 


4.3 Flight Conditions (FC) 

The closed-loop response depends on p and d as well as on the intended flight 
maneuver, denoted hereafter as /. This implies that g{p , d, /). Two flight 
conditions, namely fi on and fi at , will be consider in the analyses that follow. 
In the former one, which mostly affects the longitudinal dynamics, a step input 
in 5 ecm d is commanded. In the second one, which affects both the longitudinal 
and lateral dynamics, the vehicle also starts from level flight and a set of 
commands in 5 acm d and S rcm( i make the vehicle turn. Figures 4 and 5 show 
the vehicle’s trajectory and relevant states for the longitudinal flight condition 
when there is no uncertainty /failure. The same information corresponding 

to the lateral flight condition is shown in Figures 6 and 7. The p command 
for fi at is a sequence of two step inputs (only one is shown) where the second 
one cancels the first one after a suitable time. 


5 Results 

In this section, we evaluate the baseline controller in Equation (37) and the 
adaptive controller in Equations (38)- (42) according to the control verification 
setting of Section 4. The aerodynamic model used can be found in [9]. The 
numerical values of other variables are shown in Table 3. 
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Table 2. Cases analyzed 


Case 

Failure / U ncert ainty 


Case A 

Flight upset in angle of attack 

[Aa(0) /i on ] 

Case B 

CG movement along x-axis 

[A x /ion] 

Case C 

CG movement along y-axis 

[Ay /lat] 

Case D 

Symmetric Aileron failure 

[A ail /lat] 

Case E 

Symmetric Elevator failure 

[A-ele /ion] 

Case F 

Asymmetric Aileron failure 

[^al /lat] 

Case G 

Asymmetric Throttle failure 

[Atl /ion] 

Case H 

Elevator lock-in-place failure 

[tl /ion] 

Case I 

Time delay in all control inputs 

[T /ion] 


Table 3. ' 

Numerical Values 

Variable 

Value 

Velocity at trim 

614(ft/sec) 

Angle of Attack at trim 

2-2 (deg) 

Height at trim 

20000(ft) 

K ^ a 

-0.4420 


-0.9105 

K *e, 

-0.7906 


-0.1000 


-0.3000 

Ti 

diag( [1,1, 100, 100, 100, 100]) x 200 

r 2 

diag( [1,1, 100, 100, 100, 100]) x 100 

r 3 

diag( [1,1, 100, 100, 100, 100]) x 50 

r 4 

diag( [l, 1, 1, 1, 1, l]) x 100 

Q 

diag( [l,!,!,!,!]) 
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Figure 4. Trajectory associated with the longitudinal flight condition. 



Figure 5. Relevant states for the longitudinal flight condition. 


In Case A we consider a flight upset in the angle of attack, A«(0) about 
c*trim = 2.20(deg) for the longitudinal flight condition. The dependency of 
g on Aa(0) for both controllers is illustrated in Figure 8. The dashed lines 
and the solid lines represent results from the baseline and adaptive controllers 
respectively. A comparison of these curves shows that the non-failure region 
of the adaptive controller is larger by virtue of the structural and tracking 
performance requirements. The nominal parameter value is indicated as a 
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Figure 6. Trajectory associated with the lateral flight condition. 
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Figure 7. Relevant states for the lateral flight condition. 


vertical yellow line. The line conventions used in this figure also apply to the 
figures that follow. 

In Case B we consider the movement of the CG in the ^-direction for the 
longitudinal flight condition. Recall that a positive value of the CG movement 
denotes a forward movement. Figure 9 illustrates the dependency of g on the 
CG location for both controllers. Note that the system loses stability when 
the CG moves backward, while the tracking performance degrades the faster 
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initial condition alpha (0) (deg) 


Figure 8. Case A: g(a(0)) for the longitudinal FC. Line convention: nomi- 
nal parameter point (yellow), loading factor requirement (blue), steady-state 
requirement (green), tracking performance (red), adaptive controller (solid), 
baseline controller (dash-dot). 


when the CG moves forward. The baseline controller has a PSM of 0.175 while 
the adaptive one attains a PSM of 0.197. 

In Case C we consider the movement of the CG in the ^-direction for 
the lateral flight condition. In this setting a positive CG movement denotes 
movement to the right. Figure 10 illustrates the dependency of g on the CG 
location for both controllers. The curves are asymmetric with respect to the 
nominal parameter value, since the flight condition is itself asymmetric. As 
before, the adaptive controller attains a larger PSM. The baseline controller 
has a PSM of 0.0029 while the adaptive one attains a PSM of 0.0069. 

In Case D, we consider a symmetric failure in both ailerons, where A ai i — 
A ai = A 02 , for the lateral FC. Figure 11 illustrates the dependency of g on A a u 
for both controllers. While the PSM for the baseline is 6.6%, the PSM for 
the adaptive is 10%. In both cases, the tracking performance is the critical 
requirement. 

In Case E we consider a symmetric failure in both elevators, where A e i e — 
A ei = A e2 , for the longitudinal FC. Figure 12 illustrates the dependency of 
g on A e ie for both controllers. While the PSM for the baseline is 33%, the 
PSM for the adaptive is 42%. In both cases, the tracking performance is the 
critical requirement. As before, the adaptive controller has better robustness 
characteristics. 
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Figure 9. Case B: g(A x /c re f) for the longitudinal FC. Line convention: nom- 
inal parameter point (yellow), loading factor requirement (blue), steady-state 
requirement (green), tracking performance (red), adaptive controller (solid), 
baseline controller (dash-dot). 



eg movement along y-axis (/wing span) 


Figure 10. Case C: g(A y /b re f ) for the lateral FC. Line convention: nomi- 
nal parameter point (yellow), loading factor requirement (blue), steady-state 
requirement (green), tracking performance (red), adaptive controller (solid), 
baseline controller (dash-dot). 
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Unlike Case C, Case F considers an asymmetric aileron failure where A ai 
is uncertain and A a2 = 1. Figure 13 illustrates the dependency of g on A ai 
for both controllers. While the PSM for the baseline is 14%, the PSM for the 
adaptive is 20%. Consistently, the tracking performance requirement remains 
as a critical requirement. Note however, that the PSM corresponding to the 
stability requirement for the adaptive controller becomes smaller. 



Figure 11. Case D: g(A ai i ) for the lateral FC. Line convention: nominal pa- 
rameter point (yellow), loading factor requirement (blue), steady-state require- 
ment (green), tracking performance (red), adaptive controller (solid), baseline 
controller (dash-dot). 

In Case G we consider a failure in the left outboard engine \ t i for the 
longitudinal FC. Figure 14 illustrates the dependency of g on A*i for both con- 
trollers. While the PSM for the baseline is 1.7%, the PSM for the adaptive is 
2.9%. As before, the tracking performance is the critical requirement. Note 
that the margins obtained in this case are considerably smaller than those 
found in the other cases. The non-failure domains are small since the throttle 
inputs are not controlled and remain fixed at their trim values. A time simula- 
tion for a 40% loss in control effectiveness occuring 7s after the step input has 
been commanded is shown in Figure 15. Note that this point belongs to the 
C(J :2 ) corresponding to the adaptive controller and to the T 2 corresponding 
to the baseline. Results similar to those in Figure 14 were observed when the 
Lateral FC was used. 

A lock-in-place failure in the left elevator is considered in Case H. This is 
simulated by keeping this control input at a constant value for a period of ti 
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Figure 12. Case E: g(A e i e ) for the longitudinal FC. Line convention: nomi- 
nal parameter point (yellow), loading factor requirement (blue), steady-state 
requirement (green), tracking performance (red), adaptive controller (solid), 
baseline controller (dash-dot). 



control effectiveness in left aileron 


Figure 13. Case F: g (\ ai ) for the lateral FC. Line convention: nominal parame- 
ter point (yellow), loading factor requirement (blue), steady-state requirement 
(green), tracking performance (red), adaptive controller (solid), baseline con- 
troller (dash-dot). 
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Figure 14. Case G: g(\i) for the longitudinal FC. Line convention: nomi- 
nal parameter point (yellow), loading factor requirement (blue), steady-state 
requirement (green), tracking performance (red), adaptive controller (solid), 
baseline controller (dash-dot). 







Time (sec) 


Figure 15. Time simulation for A t i = 0.6. 
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seconds. The larger the ti the most severe the failure, being oo the practical 
case of interest. Figure 16 illustrates the dependency of g on the lock-in time. 
Substantial differences in the functional dependencies are apparent. It can be 
seen that the PSM for the baseline is 1.1 while the PSM for the adaptive is 
2.1. Note also that while the tracking performance is critical for the baseline 
controller, the stability requirement is critical for the adaptive one. Case I 



Figure 16. Case H: g{t{) for the longitudinal FC. Line convention: nomi- 
nal parameter point (yellow), loading factor requirement (blue), steady-state 
requirement (green), tracking performance (red), adaptive controller (solid), 
baseline controller (dash-dot). 

considers the case when there is a time delay r in all three control inputs. 
Figure 17 illustrates the dependency of g on this uncertain parameter for the 
longitudinal flight condition. In contrast to all other cases, the non-failure 
domain of the adaptive controller is smaller that that of the baseline. Hence, 
the nominal controller is more robust to time delay than the adaptive one. 
One may infer that this is the price of attaining improved system performance 
through aggressive actuation. Note however, that this observation may not 
hold when multiple uncertainties occur simultaneously. Figure 18 shows time 
responses for both controllers when r = 0.74s. This point belongs to the 
non-failure domain of the baseline controller and to the failure domain of the 
adaptive one. 

Table 4 summarizes the results above by presenting the relative change in 
PSM attained by the adaptive controller and the critical requirement. In all 
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time delay (sec) 


Figure 17. Case I: g(r) for the longitudinal FC. Line convention: nominal pa- 
rameter point (yellow), loading factor requirement (blue), steady-state require- 
ment (green), tracking performance (red), adaptive controller (solid), baseline 
controller (dash-dot). 
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Figure 18. Time simulation for r = 0.74s. 
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Table 4. Summary of results 


Case 

fPadap -A x 10Q% 

\ Phase J 

Critical Requirement 

A 

+4.01 % 

5i> 53 

B 

+11.4 % 

92, 93 

c 

+133 % 

92, 93 

D 

+63.6 % 

93 

E 

+27.3% 

93 

F 

+46.7 % 

93 

G 

+70.6 % 

93 

H 

+88.9 % 

92, 53 

I 

-13.9 % 

92, 93 


but one of the cases cases, the adaptive controller attains better robustness by 
a sizable margin. 
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5.1 Multi-dimensional Case 


In all the cases above a single uncertain parameter has been considered. In this 
setting, the effect of the dependencies among parameters cannot be captured. 
The same analysis can be conducted for a multi-dimensional vector p. In 
such a case, multiple failures and uncertainties occur simultaneously and the 
correlation among them may play a significant role. Studies of this type will 
be presented in the future. However, Figure 19 presents a time simulation 
of the controlled response for a multi-dimensional parameter realization when 
2 pitch rate doublets are commanded. Therein, we assume loss in control 
effectiveness of 30% for the elevators, 10% for the ailerons, and 10% for the 
rudders. In addition, the CG has been moved to the left by 0.004 b re f, and an 
initial condition in the angle of attack of 0.2 degrees is assumed. It is apparent 
that the adaptive controller achieves good tracking performance while the 
nominal controller cannot recover and makes the system unstable. 
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Figure 19. Time simulation for multiple uncertainties. 


6 Conclusions 

This paper presents an adaptive control architecture for safe flight of a trans- 
port aircraft under adverse operating conditions and uncertainties. This archi- 
tecture combines a nominal controller based on an LQR with integral action, 
and an adaptive controller that accommodates actuator saturation and dis- 
turbances. The resilience of both controllers to uncertainty is studied using 
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a control verification methodology, where flight upsets, CG movements, and 
actuator failures are considered individually. The results of this study show 
that the adaptive controller enlarges the region of satisfactory performance 
by sizable margins in all cases but one. This exception was observed in the 
case of time-delay uncertainty, case for which the adaptive controller is less 
robust than the baseline controller. A more accurate robustness assessment 
will result from considering multiple uncertainties simultaneously. Such stud- 
ies will indicate if the trends observed herein hold in a more realistic setting. 
Since the adaptive controller was not designed specifically for the uncertain- 
ties and closed-loop requirements used for its assessment, the improvements 
in robustness observed are particularly remarkable. 
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